Epic E: Realtime Robustness & Scaling

[fsecada01]

Epic E — Realtime Robustness & Scaling · Milestone: 0.7.0b (E0/E4 land in 0.6.0b) · See claudedocs/dev_plan_production_grade_2026-06-24.md

• E0 Verification spike: confirm 🟡 gaps (morph today, list keys, 422, reconnection, CSRF, partial-validation) via /sc:analyze — enabler, do first
• F1 Reconnection + automatic state-resync after WS drop (needs A1)
• E2 Unify WS fan-out via Redis pub/sub across adapters (not just Django)
• E3 Flask WS/SSE parity (Flask adapter is HTTP-only today)
• E4 Cross-adapter request-parse hardening (TypeError→400, empty-state) — from prior review
• E5 Document stateless scaling model + sticky-session guidance
• E6 Multi-user presence — only if a stateful-WS mode is pursued (post-1.0)

[fsecada01]

E0 verification spike — results (source-confirmed)

Read against current master. All previously-🟡 (unverified) gap rows are now confirmed; none were secretly already implemented — the plan scope holds.

Item	Verdict	Evidence
DOM morphing (B1)	MISSING	component-client.js update() uses wrapper.innerHTML = html + element.replaceWith(newNode) — full replace, no morph
List reconciliation keys (B3)	MISSING	no data-key/wire:key/:key/cf-key anywhere
Focus/scroll/input preservation (B2)	MISSING	no focus/scroll/selection restore in update() or rollback
422 on validation failure (D4)	CONFIRMED GAP	FastAPI/Litestar/Flask/Django all return 200 with errors in body on failed FormComponent submit (form.py.validate() sets field_errors, never raises)
WS reconnect + state resync (F1)	PARTIAL	server lifecycle exists; no client auto-reconnect, no resync on drop
CSRF per adapter (A4)	Django-only	Django via middleware; FastAPI/Litestar/Flask do no server-side CSRF validation. Note: client already sends X-CSRFToken (reads meta tag / csrftoken cookie) — mechanism exists, server validation does not
On-blur/partial validation (D2)	MISSING	form.py has only full-form validate(); on_field_change() just clears errors, no validate_field()

Implications for 0.6.0b: A1 (signed state), A4 (CSRF for non-Django HTTP), B1–B3 (morph/keys/preservation) confirmed as real, foundational work. D4 (422) is a cheap, high-value adapter fix. F1 (reconnect/resync) confirmed for 0.7.0b.

Spike performed via read-only source review; see claudedocs/dev_plan_production_grade_2026-06-24.md.